[&] What is the result of the following log analytics query (choose all that apply)?

search in (Event) "win*" |
search "OnPrem*" |
extend eData = parse_xml(EventData).DataItem.EventData.Data |
project Computer , EventLevelName , eData, TimeGenerated   |
sort  by TimeGenerated desc nulls last 
| take 100.
- The latest items are retrieved -- Correct
- The oldest items are retrieved
- The Computer, EventLevelName, TimeGenerated, and eData columns are retrieved
- The Computer, EventLevelName, TimeGenerated, columns along with content from the EventData column are retrieved -- Correct
- A table with 100 event entries that include the patterns "win" and "OnPrem" are returned -- Correct

[&] Which of the following are valid log analytics Kusto queries? (Select all that apply)
- Perf
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| summarize avg(CounterValue) by Computer
| where avg_CounterValue > 100
| render barchart kind=default     -- Correct
- search  (Onprem)
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1m) 
| render timechart 
- search  "Onprem"
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1m) 
| render timechart  -- Correct
- Perf
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1m)
| where avg_CounterValue > 100
| render timechart -- Correct
- search  Computer:"Onprem"
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1m) 
| render timechart -- Correct
- Perf
| where TimeGenerated > ago(1h)
| where (CounterName == "% Processor Time" and InstanceName == "_Total") 
| project TimeGenerated, Computer , CounterValue 
| where avg_CounterValue > 100
| summarize avg(CounterValue) by Computer, bin(TimeGenerated, 1m)
| render timechart